Skip to content

Puma doesn't handle HTTP CONNECT method #1441

@nirvdrum

Description

@nirvdrum

Steps to reproduce

  1. Run puma with any app of your choosing. Let's assume the app is running on port 9292.

  2. Make an HTTPS request to this app, as if it were a proxy server: env http_proxy=http://localhost:9393 wget https://github.com/. It doesn't matter that the app doesn't handle this route, since puma will error out before ever reaching the app.

Expected behavior

I was looking to build a proxy server with Puma. It's probably too much to expect Puma to properly handle HTTP CONNECT methods, but if it's not going to, a nice error message would be helpful.

Actual behavior

Instead of my request being handled or a friendly error message printed, I see an unrelated error message and stack trace:

#<RuntimeError: No REQUEST PATH>
/home/kjmenard/.rbenv/versions/2.3.3/lib/ruby/gems/2.3.0/gems/puma-3.10.0/lib/puma/server.rb:526:in `normalize_env'
/home/kjmenard/.rbenv/versions/2.3.3/lib/ruby/gems/2.3.0/gems/puma-3.10.0/lib/puma/server.rb:580:in `handle_request'
/home/kjmenard/.rbenv/versions/2.3.3/lib/ruby/gems/2.3.0/gems/puma-3.10.0/lib/puma/server.rb:437:in `process_client'
/home/kjmenard/.rbenv/versions/2.3.3/lib/ruby/gems/2.3.0/gems/puma-3.10.0/lib/puma/server.rb:301:in `block in run'
/home/kjmenard/.rbenv/versions/2.3.3/lib/ruby/gems/2.3.0/gems/puma-3.10.0/lib/puma/thread_pool.rb:120:in `block in spawn_thread'

There is indeed no request path passed with an HTTP CONNECT method. That part of the validation is correct. But, since the request path isn't required for HTTP CONNECT, I think the error message is a bit misleading. If Puma isn't going to handle the method, it should probably reject the request at an earlier stage.

System configuration

Ruby version: 2.3.3
Rails version: N/A
Puma version: 3.10.0

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions